ISO/IEC 27001 (ISO 27001)
The international standard for information security management systems, against which organisations can be certified.
Overview
ISO 27001 sets requirements for establishing, running and improving an information security management system, with a catalogue of controls in Annex A. The current edition was published in 2022.
As an industry standard it binds through regulation that cites it, contracts that require it or audits that test it. The authorities most closely connected to it are ISO. It is often read together with NIST CSF and SOC 2.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
Certification is often required by customers, especially in Europe.
Who it affects
Technology providers and any organisation proving security to customers.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to ISO 27001. Select one to open it.
What to do about it
- 1Decide whether it applies through regulation, contract, audit or certification.
- 2Run a gap assessment against your current controls.
- 3Crosswalk it to the regulations and contracts that reference it.
- 4Collect evidence continuously for the audit period.
From requirement to evidence.
ISO 27001 controls are mapped to NIST, SOC 2 and regulatory requirements.
Request early access →